ClawHub
Back to skill

Security audit

Meteora Liquidity Analyst

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently provides Meteora liquidity analysis using public read-only APIs and does not request wallets, credentials, persistence, or mutation authority.

Installers should understand that the skill makes live unauthenticated requests to Meteora public APIs and may provide DeFi liquidity analysis, but it cannot access a wallet or execute trades. Use its financial outputs as informational analysis, and be aware that the activation wording could be tightened to avoid use for non-Meteora Solana liquidity questions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

The skill instructs the agent to execute a shell command that fetches remote content over the network and pipes it into another program. Although the current example only pretty-prints JSON via python3 -m json.tool and does not directly execute downloaded code, embedding shell-based network fetch patterns in a skill increases the risk of unsafe command execution habits, command adaptation by the agent, and exposure to malicious or malformed remote content in less controlled environments.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

If fetch is not available in the sandbox, use bash with curl:

bash
curl -s "https://dlmm.datapi.meteora.ag/pools?limit=10" | python3 -m json.tool

Common Patterns

Vague Triggers

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest says to activate when the user asks about "Solana liquidity," "pool rankings," "AMM comparisons," or "token search," which are broad phrases that can apply to many non-Meteora contexts. Although Meteora is mentioned earlier in the sentence, the trigger scope is not tightly constrained or paired with exclusion examples, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The listed conditions include broad requests like "Looking for the best pool to LP a token pair" and "Requests global protocol metrics" without consistently stating that these must be Meteora-specific. This makes it unclear when the skill should activate versus when a more general DeFi or Solana analytics skill would be more appropriate.

Content

No source excerpt is available for this finding.